| 发明名称 |
DETECTING SECURITY VULNERABILITIES ON COMPUTING DEVICES |
| 摘要 |
Identifying security vulnerabilities on computing devices by gathering information about a first software application with which a computing device is configured, selecting, using any of the information, an attack specification from a set of predefined attack specifications, attacking the first software application on the computing device with an attack that is in accordance with the selected attack specification, identifying a post-attack condition associated with the first software application, determining whether the post-attack condition is consistent with a predefined security vulnerability, and performing a predefined action associated with the predefined security vulnerability responsive to determining that the post-attack condition is consistent with the predefined security vulnerability, where the gathering, selecting, attacking, identifying, determining, and performing are performed by a second software application during execution of the second software application on the computing device. |
| 申请公布号 |
US2014373158(A1) |
申请公布日期 |
2014.12.18 |
| 申请号 |
US201313920540 |
申请日期 |
2013.06.18 |
| 申请人 |
International Business Machines Corporation |
发明人 |
Hay Roee;Kalman Daniel;Saltzman Roi;Tripp Omer |
| 分类号 |
G06F21/57 |
主分类号 |
G06F21/57 |
| 代理机构 |
|
代理人 |
|
| 主权项 |
1. A method for identifying security vulnerabilities on computing devices, the method comprising:
gathering information about a first software application with which a computing device is configured; selecting, using any of the information, an attack specification from a set of predefined attack specifications; attacking the first software application on the computing device with an attack that is in accordance with the selected attack specification; identifying a post-attack condition associated with the first software application; determining whether the post-attack condition is consistent with a predefined security vulnerability; and performing a predefined action associated with the predefined security vulnerability responsive to determining that the post-attack condition is consistent with the predefined security vulnerability, wherein the gathering, selecting, attacking, identifying, determining, and performing are performed by a second software application during execution of the second software application on the computing device. |
| 地址 |
Armonk NY US |
